PrivateBin shares text and files with true zero-knowledge encryption: the server stores only ciphertext it cannot decrypt because the key exists exclusively in the URL fragment that never reaches the server. With over 8,400 GitHub stars and 500,000+ Docker pulls, it has become the standard for privacy-respecting paste sharing where not even the hosting operator can read stored content. All encryption uses 256-bit AES in Galois Counter mode performed entirely client-side in the browser. Burn-after-reading mode destroys pastes on first view, while configurable expiration timers automatically purge content after periods ranging from five minutes to forever. Optional password protection adds a second encryption layer requiring recipients to enter a passphrase before decryption occurs. Discussion threads enable anonymous or nickname-based commenting on pastes with IP-based identicon avatars for visual identity. Markdown rendering with live preview formats pastes as styled HTML, and syntax highlighting through prettify.js supports dozens of programming languages across four color themes. File upload support enables sharing images, PDFs, and media files with in-browser preview. QR code generation converts paste URLs for mobile device transfer. Customizable templates include Bootstrap 5, classic Bootstrap CSS, and Darkstrap themes. Storage backends support filesystem, MySQL, PostgreSQL, SQLite, Amazon S3, and Google Cloud Storage. Deploy via Docker with the privatebin/nginx-fpm-alpine image on port 8080. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. zlib licensed.

With over 9,000 GitHub stars earned since Google killed its browser-based Timeline, Dawarich fills the gap with a fully self-hosted location history platform that keeps your movement data under your control. Built on Ruby on Rails 8.0 with PostgreSQL and the PostGIS spatial extension for geometry-based queries, Dawarich imports your entire Google Takeout location archive in minutes and begins rendering interactive maps immediately. The visualization engine supports five map layers — heatmaps, points, lines, Fog of War exploration tracking, and a 3D globe view — each powered by Leaflet and spatial SQL rather than browser-side computation. Native iOS and Android apps handle background GPS tracking with offline support, automatically uploading location points when connectivity returns, while third-party integrations support OwnTracks, GPSLogger, Overland, Home Assistant, Traccar, and PhoneTrack. The trip system lets you create route visualizations between any two dates, attach notes, replay travel paths with a timeline scrubber, and share trips publicly with phrase-protected links and per-section visibility controls. Immich and PhotoPrism integrations automatically overlay geotagged photos on your maps and trips, while AirTrail integration renders flight history as arcs. Statistics dashboards break down countries visited, cities explored, total distance traveled, and active days by year and month, with visit detection suggesting places you have frequented. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Calendars, to-do lists, journal entries, and contacts, synced over the open CalDAV and CardDAV standards nearly every client already speaks: Radicale is a small pure-Python server that works with Thunderbird, DAVx5 on Android, Apple Calendar and Contacts, GNOME, and many more. Its defining design choice is radical simplicity: there is no database. Events live as plain .ics files and contacts as .vcf files in an ordinary folder structure, which makes backup a copy command, migration a move, and disaster recovery a matter of reading text files. The server works out of the box with no complicated setup, then grows as needed: flexible authentication (htpasswd files among other methods), per-collection authorization rules, TLS-secured connections, and a plugin system for extending storage, auth, and rights handling. Built-in limits on parallel connections, file sizes, and failed authentication attempts harden it for network exposure behind a reverse proxy. A bundled web interface handles creating and managing calendars and address books - useful since many clients cannot create collections themselves. Maintained since 2011 with 140+ contributors, GPLv3-licensed, and light enough to run on the smallest VPS or a Raspberry Pi.

Zero unifies Gmail, Outlook, and IMAP accounts into a single AI-enhanced inbox with keyboard-driven navigation that matches premium email clients in speed. Backed by 10,000+ stars and positioned as the alternative to Superhuman, it keeps your email data in your own PostgreSQL database while LLM agents handle categorization, priority sorting, draft composition, and natural language mailbox queries. You choose whether models run locally or through cloud providers you control. The Next.js and React interface delivers customizable keyboard shortcuts for every action: reading, archiving, labeling, composing. A WorkflowEngine defines automated multi-step rules including label application, bulk archiving, and conditional routing based on sender, subject, or content analysis. Built on Drizzle ORM with Better Auth handling Google OAuth, styled with TailwindCSS and Shadcn UI components, the interface is polished without being bloated. MCP integration exposes email management tools to external AI assistants for programmatic inbox control through standardized protocols. The Nizzy CLI handles environment configuration, database synchronization, and development server orchestration. Deploys via Docker Compose with a single database initialization command. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Roughly $1M of development work, open-sourced: Maybe Finance began as a $249/year commercial personal finance product before the company released it all. It aggregates bank accounts, credit cards, loans, investments, crypto, and real estate into a single net worth dashboard with historical trend charts - replacing the spreadsheet that usually glues a whole portfolio together. Transactions are categorized and tagged with rules, with merchant tracking and search across imported or synced activity; budgets track spending by category against plan; and the investment view follows holdings, cost basis, and returns across brokerage accounts. Multi-currency support converts accounts held in different currencies into a single reporting currency, bank synchronization works through Plaid where supported, and manual CSV import covers any institution. An optional AI assistant answers questions grounded in your own financial data. Because the app was built as a paid product with professional design before being open-sourced, its interface quality exceeds most community finance tools - and self-hosting means your balances and transactions are not monetized by a free app or gated behind an annual subscription. The stack is Ruby on Rails with Hotwire on PostgreSQL, licensed AGPL-3.0 and deployed via Docker. The original repository is archived; development continues in the community fork Sure, compatible with the same self-hosted setup.

Your medical history, fragmented across a dozen patient portals, in one place on your server: MediKeep (formerly Personal Medical Records Keeper) is a self-hosted health record system. Built with a React frontend and FastAPI backend over PostgreSQL, it organizes 14 categories of medical data - medications with dosages and schedules, conditions, procedures, allergies, immunizations, symptoms, injuries, doctor visits and encounters, treatments, lab results, and even medical equipment with service dates and supplier info. Treatment management is genuinely sophisticated: an advanced mode links treatments to their medications with per-medication overrides for prescriber, pharmacy, and effective dates, and reverse lookup shows which treatments use a given medication. A dashboard summarizes records and recent activity, file uploads attach documents to records, and tagging works across categories. When a new specialist asks for your history, the report builder assembles custom reports by category and exports to PDF, JSON, or CSV - a curated, portable summary instead of a folder of photocopies. Authentication supports Google and GitHub SSO with OIDC providers like Keycloak and Authelia expected to work, and the built-in backup system protects the archive. Health data is exactly what should never live in someone else's cloud.

Up to 280 search services - Google, Bing, DuckDuckGo, Brave, Qwant, Startpage - aggregated without tracking or profiling: SearXNG is a privacy-respecting metasearch engine (AGPL-3.0, successor to Searx). Your instance queries the upstream engines on your behalf: your IP address, cookies, and search history never reach them, tracker parameters are stripped from result URLs, and an optional image proxy fetches thumbnails server-side so result pages leak nothing. It can even route outbound queries through Tor for full anonymity. Search is organized into categories - general, images, videos, news, maps, music, IT, science, files - with bang shortcuts for targeting specific engines, and every source can be enabled, disabled, or weighted per category in settings.yml. A plugin system adds calculators, hash tools, tracker removal, and unit conversions inline, and preferences (themes, safe search, languages, engine selection) persist in cookies rather than server-side accounts. The real argument for running your own instance rather than trusting a public one is control: you decide the logging policy (none), the engine mix, rate limiting, and who gets access - making it the default search backend for browsers, families, and teams that want Google-quality results without the profile.

Your KeePass vaults, opened from any browser: KeeWeb reads, edits, and creates standard KDBX files, so it works with the same databases as KeePass and KeePassXC without conversion or lock-in. Self-hosting the web app gives you a password manager reachable from any modern browser, including mobile, with no client installation and no third-party cloud in the loop. All KDBX cryptography runs client-side; the server just serves the static app. Open multiple vault files simultaneously and search them all from one box, with advanced options covering specific fields, password history, and regular expressions. Vaults load from local files, your own server (WebDAV), or Dropbox, Google Drive, and OneDrive, with automatic sync - and files are cached for offline use, so a dropped connection never locks you out; changes resync once you're back online. Day-to-day niceties include a configurable password generator, protected fields that stay masked and are held in memory more defensively, entry history, tags with easy input, drag-and-drop attachments, and per-entry icons with favicon fetching. The optional KeeWeb Connect extension (Chrome, Firefox, Edge, Safari) autofills credentials using the keepassxc-protocol. MIT-licensed with matching desktop apps for macOS, Windows, and Linux.

No targets, no gamification spiral, no motivational nagging: Beaver Habit Tracker is a self-hosted habit tracker deliberately built without "Goals". The core loop is honest: add habits, check them off each day, watch streaks accumulate on a calendar view. Its design follows behavioral-science basics - make it obvious (visual streak cues), make it attractive (progress is the motivator), make it satisfying (tracking becomes its own reward). Beyond the daily checklist it supports per-day notes intelligently grouped per habit, periodic habits, habit categories and tags, drag-to-reorder (manual or automatic), dark mode, and detailed streak and frequency views. Data lives where you choose: a single SQLite database or flat JSON files on a mounted volume, with JSON export and import for full portability. A REST API opens automation - community integrations already cover Stream Deck buttons, Home Assistant triggers, and CalDAV. The Python app ships as one Docker container with no external dependencies; environment variables tune everything from first day of week and index-page columns to iOS standalone PWA mode, and single-user setups can bypass the login entirely with TRUSTED_LOCAL_EMAIL. BSD-3-Clause licensed with no commercial restrictions - a well-executed single-purpose tool whose mobile PWA works anywhere a browser does.

Known as the open-source Mixpanel alternative that respects user privacy, OpenPanel delivers a unified web and product analytics platform combining Mixpanel's behavioral analysis with the simplicity of Plausible and full data ownership through self-hosting. Cookieless tracking eliminates consent banners entirely while still capturing events, page views, sessions, user journeys, funnels, retention cohorts, and custom properties with full GDPR compliance by design. The 2.3 KB async script loads without blocking page rendering, and 16 official SDKs cover Next.js, React, Vue, Astro, Remix, Nuxt, Angular, Svelte, React Native, Swift, Kotlin, Python, PHP, Laravel, Express, and REST API for custom integrations. Real-time dashboards display live visitor counts, active sessions, and event streams as they happen. Custom chart builders create tailored visualizations from any tracked event with breakdowns by property, time period, and user segment. Session replay reconstructs individual user journeys showing every page visited, event triggered, and interaction recorded. Funnel analysis identifies conversion drop-offs with step-by-step breakdown and property filtering. Retention analysis measures how often users return with customizable time windows and cohort comparisons. A/B testing and variant tracking enable experiment measurement directly within the platform. Event notifications alert when specific events occur or thresholds are crossed. The self-hosted deployment uses Docker Compose with ClickHouse for high-speed analytical queries, PostgreSQL for metadata, and Redis for real-time processing — deployable on any VPS or Kubernetes cluster. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Crypto portfolio tracking that inverts the SaaS model: rotki runs on your own machine, needs no email or account for the free tier, and keeps every wallet address, balance, transaction, and tax event in a local SQLCipher database encrypted with 256-bit AES. By default nothing passes through rotki-operated servers - a design choice that matters when cloud portfolio trackers concentrate exactly the identity-linked holdings data attackers want. Centralized exchanges (Kraken, Binance, Coinbase, Bitstamp, and more) connect through read-only API keys that can see but never withdraw; blockchain accounts cover Ethereum and its L2s, Bitcoin, Solana, Polkadot, and Kusama, with ENS resolution and your choice of RPC endpoint or your own node. rotki decodes on-chain transactions into readable events across major DeFi protocols - Aave, Uniswap, Compound, Curve, Lido - and generates profit-and- loss reports for tax season with customizable accounting settings, including FIFO, LIFO, and HIFO cost-basis methods, plus CSV imports for defunct exchanges. Optional premium sync is zero-knowledge, encrypting the database on-device before upload. AGPLv3-licensed and multiplatform, with a Docker package for server deployment.

Machine translation with no Google, no Azure, no per-character billing, and no text leaving your infrastructure: LibreTranslate is a free, open-source translation API that runs entirely on your own server. The engine underneath is Argos Translate, which runs OpenNMT neural models with SentencePiece tokenization and Stanza sentence-boundary detection, all offline. Models install as portable .argosmodel packages covering dozens of languages - English, Spanish, French, German, Chinese, Japanese, Russian, Arabic, Hindi, Portuguese, and many more - and Argos handles automatic pivoting: with es-to-en and en-to-fr installed, it chains them to translate es-to-fr without a direct model. The API is a straightforward HTTP POST to /translate with source and target language codes, returning JSON - simple enough that the ecosystem has clients in every major language and integrations across tools like Weblate and Mastodon. Beyond plain text it translates HTML while preserving markup and handles whole file uploads (documents in, translated documents out), plus automatic language detection when the source is unknown. A clean bundled web UI serves interactive translation for end users, and optional API keys with rate limits control access. AGPL-licensed and trainable with custom models, it is the standard answer when translation must be private, unmetered, and self-contained - GDPR-sensitive text never touches a third party.

Real-time alerts from your own infrastructure to your phone, with no Firebase, Pushover, or third-party push service in the path: Gotify is a simple, self-hosted notification server written in Go. The model is deliberately minimal: senders push messages with a single HTTP POST to the REST API, receivers subscribe over a WebSocket stream, and a clean React web UI manages the pieces. Senders are namespaced as "applications," each with its own token, so your backup script, Uptime Kuma, CI pipeline, and cron jobs each get an identity, an icon, and independently revocable credentials - centralized alerting from many services with per-source management. Messages carry a title, body, and priority level that maps to notification importance on the client. The official Android app (on both F-Droid and Google Play, notable for working entirely without Google Play Services) shows push notifications for new messages; the web UI itself supports Web Push in the browser; and gotify/cli pushes messages from shell scripts with one command. A server-side plugin system adds custom behavior, and the whole thing runs as a single small binary with SQLite by default - near-zero resource footprint. Because dozens of tools (and Apprise) speak Gotify natively, it slots in as the notification hub for an entire homelab or ops stack.

Live web search plus an LLM of your choice: Farfalle is an open-source, self-hosted answer engine in the Perplexity mold. Queries route through one of several search providers - self-hosted SearXNG for a fully independent stack, or Tavily, Serper, and Bing APIs - and the model composes a cited answer from the retrieved results. Model flexibility is the core design: run llama3, mistral, gemma, or phi3 locally through Ollama for zero per-query cost and full privacy, use cloud models like GPT-4o or Groq-hosted Llama 3 for speed, or route to any provider via LiteLLM. An Expert Search mode uses an agent that plans a multi-step search strategy and executes it for harder questions, and chat history keeps prior research sessions available. The stack is a Next.js and shadcn/ui frontend over a FastAPI backend with Redis rate limiting, shipped as a pre-built Docker image. A browser search-engine entry pointing at your instance makes it the default search from the address bar. Paired with SearXNG and Ollama, the whole pipeline runs with no external API at all.

Notes on Windows, macOS, Linux, Android, iOS, and the terminal, synced through your own server: Joplin pairs its open-source clients with Joplin Server, the official self-hosted backend that replaces Dropbox, OneDrive, or Nextcloud as the synchronization target. Notes are Markdown with inline attachments (images, PDFs, audio), organized into hierarchical notebooks and sub-notebooks with cross-cutting tags, alongside to-do lists with reminders and alarms. End-to-end encryption is the headline feature: enabled in the clients, it encrypts sync payloads on-device before upload, so the server stores blobs it cannot read - genuine protection even if the host is compromised. The desktop app offers both Rich Text and Markdown editors, extended by a plugin ecosystem, custom themes, and an Extension API for writing your own scripts; a Web Clipper for Chrome and Firefox captures full pages or screenshots straight into notebooks. Joplin Server ships as a Docker image with SQLite for evaluation and PostgreSQL for production, offers a filesystem storage driver for large content, and includes multi-user support and note sharing - all free under AGPL-3.0 when self-hosted. Notes stay in an open format, so the exit path always exists.

Several EU data protection authorities have ruled Google Analytics deployments unlawful; Matomo (formerly Piwik) is the most complete open-source replacement - a full analytics platform with 30+ report types across visitors, actions, referrers, goals, and ecommerce. The self-hosted PHP/MySQL edition is free and keeps every byte of visitor data on your infrastructure, which matters more each year: several EU data protection authorities have ruled Google Analytics deployments unlawful, while Matomo configured for cookieless tracking is approved by France's CNIL for use without a consent banner. All reporting runs on 100% unsampled data - no extrapolation at high traffic volumes. The GDPR Manager handles data subject requests and deletion, with IP anonymization, retention controls, and Do Not Track support built in. A dedicated importer pulls your historical Google Analytics data so years of trends survive the migration. Core analytics cover campaigns, custom variables and dimensions, entry/exit pages, downloads, site search, and full ecommerce tracking with a comprehensive HTTP API for reporting and ingestion. Premium plugins extend the platform into Hotjar-class behavioral tooling - click and scroll heatmaps, session recordings, conversion funnels, form analytics, A/B testing - plus a tag manager and SAML SSO. For teams that need GA-equivalent depth with actual data ownership, Matomo is the realistic drop-in replacement.

SnappyMail is a fast, privacy-respecting webmail client that connects to any existing IMAP and SMTP server, booting in under a second with a JavaScript payload of just 138 KB under Brotli compression (down from RainLoop's 8 MB fork origin). No database is required: all configuration and user data persists as flat files in a single volume, making Docker deployment trivially simple with the roughly 30 MB image consuming approximately 50 MB of RAM. Built-in PGP encryption supports three backends: OpenPGP.js v5 with ECDSA and EDDSA key generation, GnuPG integration, and Mailvelope browser extension compatibility, eliminating the need for separate encryption plugins. The integrated Sieve script editor enables users to create mail filtering rules, vacation auto-responders, and forwarding conditions directly within the web interface when connected to ManageSieve-capable servers on port 4190. Multi-domain administration allows a single instance to serve users across multiple IMAP servers with per-domain authentication routing. The admin panel manages extensions, security settings, branding customization, and domain configuration. GDPR-friendly by design, it removes all social media integrations, Gravatar lookups, and external tracking present in RainLoop. Dark mode strips background and font colors from email messages. The modified Squire HTML editor replaces CKEditor for composing rich-text messages. Scores 99% on Lighthouse performance. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

The most feature-complete open-source alternative to Google's NotebookLM — a self-hosted research platform where you upload PDFs, videos, audio files, and web pages into organized notebooks, then chat with your content, generate multi-speaker podcasts, and run semantic search across everything without sending a single byte to Google's servers. The podcast engine supports 1-4 fully customizable speakers with backstories, personalities, and expertise profiles, generating professional audio dialogue through OpenAI, ElevenLabs, Google TTS, or completely local text-to-speech via Kokoro for maximum privacy. Content processing uses token-based chunking with RAG-powered retrieval grounded in your uploaded sources, while both full-text keyword search and semantic vector search via SurrealDB enable conceptual discovery across all notebooks. The 18+ supported AI providers include OpenAI, Anthropic, Google Gemini, Groq, Ollama, LM Studio, and more — configurable per task so you can route cheap models to summarization and powerful models to analysis. Content transformations extract insights, generate summaries, create study guides, and produce structured outputs from any source material. The MCP integration connects Open Notebook to Claude Desktop, VS Code, and other MCP clients for seamless workflow integration. A full REST API on port 5055 enables complete automation of notebook management, source upload, and podcast generation. Deploy via Docker Compose with the application container, SurrealDB v2 on RocksDB, and optional TTS containers. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.